Files

T

Moritz Schmitz von Hülstandkfox1111 43a72a22ff Add example for using SPIRE for mTLS with Keycloak (#248 )

* Add example for using Spire for mTLS with Keycloak

Signed-off-by: Moritz Schmitz von Hülst <[email protected]>

* Minor improvement to the README.md

Signed-off-by: Moritz Schmitz von Hülst <[email protected]>

* But I still need to learn GitHub Markdown format

Signed-off-by: Moritz Schmitz von Hülst <[email protected]>

* Make it more obvious that it works without a (correct) password

Signed-off-by: Moritz Schmitz von Hülst <[email protected]>

* Add warning for Kubernetes 1.29+ feature

Signed-off-by: Moritz Schmitz von Hülst <[email protected]>

* Move ghostunnel into an initContainer with restartPolicy=Always

Signed-off-by: Moritz Schmitz von Hülst <[email protected]>

* Apply suggestions from code review

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Moritz Schmitz von Hülst <[email protected]>

* Move java-spiffe-helper-properties into extraDeploy of the Keycloak chart and pin node version to it has a matching rancher/kubectl image

Signed-off-by: Moritz Schmitz von Hülst <[email protected]>

---------

Signed-off-by: Moritz Schmitz von Hülst <[email protected]>
Co-authored-by: kfox1111 <[email protected]>

2024-02-19 04:33:01 -08:00

2.2 KiB

Raw Blame History

keycloak-config-cli using spire

Warning

This example uses the SidecarContainers feature. This is only enabled by default in Kubernetes 1.29+.

This example shows how to leverage SPIRE in establishing an mTLS connection between Keycloak and keycloak-config-cli, a tool to configure Keycloak.

Setup

Create a local cluster for testing

kind create cluster --image kindest/node:v1.29.0

Install CRDs

helm upgrade --install -n spire-server spire-crds ../../charts/spire-crds --create-namespace

Install spire-server

helm upgrade --install -n spire-server spire ../../charts/spire --create-namespace -f spire-values.yaml

Install keycloak (this also configures Keycloak for client certificate authentication)

helm upgrade --install keycloak oci://registry-1.docker.io/bitnamicharts/keycloak -f keycloak-values.yaml

Install keycloak-config-cli

kubectl apply -f keycloak-config-cli.yaml

Verify the realm config at the bottom of keycloak-config-cli.yaml has been created!
Cleanup

kind delete cluster

Notes

java-spiffe-helper as Keycloak initContainer

This example uses java-spiffe-helper as an initContainer for Keycloak. It fetches the certificates from the spire-agent and conveniently provides them to Keycloak in pkcs12 format.

Important

Keycloak does not rotate the certificates like SPIRE does. If you want to run the keycloak-config-cli job again, you need to make sure Keycloak is also restarted/provided with non-expired certificates.

Common name as username

This example is configured to read the username from the common name (CN) from the client certificate. Keycloak has some options there, this looked like the easiest one. SPIRE joins the values from dnsNameTemplates in the common name section of the certificate, so make sure you can somehow extract the username from it.

2.2 KiB Raw Blame History